fix: keep checksum verification when commitlint is public

[SafeEval]

Found while auditing both repos for public release. This is the one code change I'd want landed before publishing.

The problem

The install step sets GOPRIVATE unconditionally. That's necessary for a private module — the proxy and checksum database can't see one — but per Go's own documentation it also disables checksum-database validation:

GOINSECURE does not disable checksum database validation. GOPRIVATE or GONOSUMDB may be used to achieve that.

So once commitlint is public, every user of this action would silently forfeit supply-chain verification they should be getting, with nothing in the workflow output indicating it.

The fix

Try the ordinary public install first; fall back to credentials only if it fails, with GOPRIVATE scoped to that fallback:

if go install "github.com/DivergentCodes/commitlint@${VERSION}"; then
  exit 0          # public path — proxy + checksum verification intact
fi
# ... otherwise rewrite URLs with the token and retry with GOPRIVATE

A public commitlint keeps full verification. A private one still works exactly as before.

Also replaces git's terminal prompts disabled — which doesn't say what to do — with an ::error:: naming the actual cause and the input to set.

Verification

All three paths exercised, not just the happy one:

Scenario	Result
Public module, no token	installs via public path, no GOPRIVATE
Private module, no token	::error:: naming the cause, exit 1
Private module, with credentials	falls back and installs commitlint v1.1.2

action.yml parses, actionlint clean, install script passes bash -n.

Public-readiness audit (context)

Scanned both repos' complete history, not just current files: 0 secret-pattern hits across 107 objects, no deleted files hiding in old blobs, 0 internal-infrastructure references, MIT licensed, and neither uses pull_request_target/workflow_run — so fork PRs never receive secrets. release.yml holds contents: write but only triggers on push to main and tags, which forks cannot do.

Both repos are safe to publish. This PR is the one substantive improvement worth landing first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML